We do not maintain formal written cybersecurity policies, a documented risk assessment process, or a documented incident response plan. We hold no customer data and process no customer payments. Our email, file storage, and engineering data are held on systems provided by third parties, and we rely primarily on the security measures of those providers. We require multi-factor authentication for access to our banking and accounting systems, but we have not implemented it across all of our systems. We have not established a process for assessing cybersecurity risk at our vendors.

The information most significant to us is our technical data, including test results and invention disclosures that have not yet been the subject of patent applications. Unauthorized disclosure of that information could impair our ability to obtain patent protection, could benefit competitors, and could reduce the value of our intellectual property.

We do not have a separately designated standing audit committee, and our Board of Directors as a whole oversees risk, including cybersecurity risk. Our Chief Executive Officer is responsible for cybersecurity matters and reports to the Board. We do not have a chief information security officer or dedicated information security personnel, and we have not engaged a third party to assess our cybersecurity program.

We are not aware of any cybersecurity incident that has materially affected us, and we have not incurred material expenses relating to cybersecurity incidents during the last two fiscal years. Because we do not maintain formal cybersecurity processes and rely substantially on third-party systems and vendors, we may be unable to prevent or promptly detect an incident. A cybersecurity incident affecting us or any of our vendors could disrupt our operations, result in the loss or disclosure of our technical data, or damage our business relationships and reputation. See Item 1A, Risk Factors.